Update Feed

Simple Machines Forum 2.0.3

16 December 2012

Simple Machines Forum version 2.0.3 is now available.

Upgrading to Simple Machines Forum 2.0.3

Simple Machines Forum 2.0.3 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply Simple Machines Forum updates as new versions are released, or use Installatron's Clone feature to duplicate an existing Simple Machines Forum install to test the 2.0.3 upgrade prior to applying it live. Get started managing your Simple Machines Forum installations with Installatron

What's New in Simple Machines Forum 2.0.3

Critical security issues have been identified and are fixed with this update, therefore it is recommended to make sure you update your forums immediately to ensure your community is safe. A few other minor bugs have also been fixed. The most relevant bug fix is an issue that will arise in few months with PayPal: starting on February 1, 2013 PayPal will only accept headers which comply with the HTTP 1.1 specification.

SSI showed hidden boards on non-properly configured forums (part 2)
SSI showed hidden boards on non-properly configured forums
XSS in moderation log page (thanks kingW3 for the report)
ManagePaid fails if copies of Subscriptions-Paypal,php are present
PCRE engine starting at rev 8.3, will not allow you to specify the surrogate range D800–DFFF - From Spuds (similar to commit 10994)
Fixed lacking of check on referer URL when adminLogin comes into play (1.0, 1.1 and 2.0 versions)
Fixes for paypal moving to HTTP 1.1 [bug 5009]
update sandbox to use https, the former address results in a redirect
curl did not work due to improper check
subscriptions should also check for approved payment. Cherry-picked from git commit 07d4bc9fba8942fd284d3d0c3c732889a7bc2e6f by Spuds
Fixed the upgrade.php failing when the Themes directory was in a directory other than $boarddir (thanks iacchi for finding the cause)
Applied all the changes proposed by rawlogic to fix the intermittent session verification failures